https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335392#M62037 <P>We see the message <CODE>INFO WatchedFile - Will begin reading at offset=313 for file xxxx</CODE> and the input file is exactly 313 characters and it was not indexed so far. We added <CODE>crcSalt = &lt;SOURCE&gt;</CODE> and it didn't help.</P> <P>How can we do to get this file to be indexed?</P> Thu, 27 Jul 2017 19:07:42 GMT ddrillic 2017-07-27T19:07:42Z https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335392#M62037 <P>We see the message <CODE>INFO WatchedFile - Will begin reading at offset=313 for file xxxx</CODE> and the input file is exactly 313 characters and it was not indexed so far. We added <CODE>crcSalt = &lt;SOURCE&gt;</CODE> and it didn't help.</P> <P>How can we do to get this file to be indexed?</P> Thu, 27 Jul 2017 19:07:42 GMT https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335392#M62037 ddrillic 2017-07-27T19:07:42Z https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335393#M62038 <P>what does <CODE>./splunk list inputstatus</CODE> say for this input?</P> <P>Sounds like we knew about the file and have the seekptr in the fishbucket. Maybe try and zap the fishbucket?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport#btprobe">http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport#btprobe</A></P> <PRE><CODE>./splunk cmd btprobe -d /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db --file /var/log/messages --reset </CODE></PRE> <P>Are you sure we haven't indexed it? Have you searched all time?</P> Thu, 27 Jul 2017 19:14:49 GMT https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335393#M62038 mattymo 2017-07-27T19:14:49Z https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335394#M62039 <P>Perfect. I searched all time...</P> <P>I ran the command and got back - </P> <PRE><CODE>Using logging configuration at /opt/splunk/splunkforwarder/etc/log-cmdline.cfg. key=0xc70a454221239041 scrc=0xefd9b0699540a4c0 sptr=314 fcrc=0xd2febf0eb34e3560 flen=0 mdtm=1501003479 wrtm=1501043870 </CODE></PRE> <P>What does it mean?</P> Thu, 27 Jul 2017 19:45:25 GMT https://community.splunk.com/t5/Getting-Data-In/Why-a-tiny-file-doesn-t-get-indexed/m-p/335394#M62039 ddrillic 2017-07-27T19:45:25Z